Forum Moderators: open
I have a question. I need to pass parameters to my server using Javascript. The basic idea, is that I need to run a .php file, which requires a user/password. So it looks like -
[mydomain.com...]
It's pretty simple. I'm using this code from a toolbar that is running on a computer (and is running javascript). My question - how secure is that? From what I'm guessing, my user/password combination is wide open in the network... is there some way I can easily encrypt those user/password combination before I send them on the URL?
Thanks!
Ron
Use these to hash your password before you send it to the server. However, be aware that these hashes can be cracked with enough time and effort.
In order to prevent that, when your toolbar is installed and the user registers, generate a "salt" that is completely random, preferably at least 20 characters in length. Hash this in with the password to prevent dictionary and most brute-force attacks. Then, make sure both the server and the toolbar keep track of this salt, and use it whenever you need to hash a password.
This will make it much more challenging for someone to steal a user's password. What it will NOT do is make your toolbar more secure. Anyone advanced enough to run network tracing will be able to snoop on the request, note the information (whether it's GET or POST doesn't matter), then simulate the request himself and access the targeted user's data.
To get around this, you'll need a public/private key encryption system (which I haven't researched for Javascript/PHP--there might be something, but I don't know what it is), along with some unique, random value that is sent from every toolbar installation (and is randomized for each request). Verify that the toolbar goes with the user, and that the random value from inside the encryption is correct (I.E. it matches a random value passed outside the encryption), and you can provide at least some form of security.
Unless you're using https, however, just be aware that almost anything you do with this type of architecture can be defeated relatively easily if someone's determined enough.
Thanks. That is great info.
So first of all I understand that GET and POST are the same, security wise, which makes sense.
I like the idea of using Public-Key/Private-Key encryption. I'll look into this.
I'll also look into HTTPS, a I'm still not 100% sure I understand how it applies.
Thanks!
Ron
Maybe I'll stick to encryption on Javascript and decryption on my PHP server (private-key/public-key). Perhaps indeed using a different 'salt' for each toolbar (which is possible I guess).
So first of all I understand that GET and POST are the same, security wise, which makes sense
Actually, in the context you're using it, they are not.
GET will put the submitted variables in the query string and will appear in the address bar like so:
script.php?var1=value%201&var2=%202
Post sends the data in a stream read on STDIN, and does not:
script.php
Security-wise this is one less place to "peek" at your data.
The other major difference is the bytes of data you send with GET are limited, POST will allow as much data as you can stand to post.
Thanks for the info. So POST is a 'little' bit better security-wise, but certainly not enough deliver sensitive data, right?
I'm now trying to get RSA to work (encode in JS, decode in PHP) which is 'almost' working ;-)
Ron
